Disconnect Internally but not remotely

AlexMcCreery — Fri, 27 Feb 2026 14:33:19 GMT

We have some users who need to connect to part of our network that isn't routable which means GP cannot connect when they are plugged into it.

In order for them to do their work, they need to be able to disconnect from GP.

I am wondering if there is a setup where if the user is on the internal network and connected to an internal gateway, they can disconnect from GP? But when the same user is connected externally, they are not allowed to disconnect?

Any suggestions would be appreciated!

Re: Disconnect Internally but not remotely

BPry — Wed, 04 Mar 2026 22:33:38 GMT

@AlexMcCreery,

Do you utilize internal gateways? Do you need to utilize internal gateways?

There's no native way to accomplish what you are asking, but if you utilize internal network detection and simply don't utilize an internal gateway things will work perfectly fine. If you require the use of an internal gateway, there's really not a way to accomplish this only when they're connected to the one subnet.

Something that you could do is create a small service that performs some checks and then modifies the registry value, restarts PanGPS to read it, and then allows them to disconnect. Thus you wouldn't need to modify your current portal options but you effectively get what you're asking for. That requires some development though, so while it's a possibility it isn't something everyone would have the capability to build in-house.

topic Disconnect Internally but not remotely in GlobalProtect Discussions

Disconnect Internally but not remotely

Re: Disconnect Internally but not remotely